4 ms·
https://github.com/git/git/commit/9a6bbee8006c24b46a85d29e7b38cfa79e9ab21b https://github.com/git/git/commit/9a6bbee8006c24b46a85d29e7b... Hmm, it makes sense
by oefrha 7y ago
https://github.com/git/git/commit/9a6bbee8006c24b46a85d29e7b38cfa79e9ab21b https://github.com/git/git/commit/9a6bbee8006c24b46a85d29e7b...
Hmm, it makes sense to catch the error when writing, but I wonder why not fix the parser as well? https://example.com?foo=bar https://example.com?foo=bar is a valid URI reference per RFC 3986 and doesn’t look so malicious yet it’s still parsed wrong. (I didn’t bother to track down and read the parser code.)
- peff 7y agoThe parser problem made it worse, but it was neither necessary nor sufficient for the vulnerability. We are fixing it, but decided to leave it out of the critical release path. See https://lore.kernel.org/git/20200414214304.GA1887601@coredump.intra.peff.net/ https://lore.kernel.org/git/20200414214304.GA1887601@coredum...
- oefrha 7y agoCool, thanks for the follow-up.